topic Re: Using earliest and latest variables in a form in Splunk Search

Using earliest and latest variables in a form

adylent — Fri, 10 Jan 2014 20:27:58 GMT

(Using Splunk6) Does any one know if Splunk can do something similar to this

<fieldset autoRun="false" submitButton="true">
        <input type="text" token="earliest">
          <label>earliest time</label>
          <default>now</default>
        </input>
        <input type="text" token="latest">
          <label>latest time</label>
          <default>now</default>
        </input>
</fieldset>

I'm wanting to not use a timepicker, but instead, give them two text boxes where they can specify a date range.

Everytime I try to supply values I get:
Invalid earliest_time

Except if I enter 0 for earliest and now for latest.

I've tried both

$earliest$>
$latest$

and then also

earliest=$earliest$ latest=$latest$

in the search

Thanks

Re: Using earliest and latest variables in a form

sowings — Fri, 10 Jan 2014 20:37:14 GMT

You can probably do it given what you've specified as a text box, but you'd have to use the relative time specifiers (e.g. "-5m", "@d") or a fully formatted time stamp ("2014/01/09:00:00:00"), or an epoch time ("1389386013").

It might be easier to use a time picker, since it's a full-featured control with lots of ways to specify the time.

Re: Using earliest and latest variables in a form

adylent — Fri, 10 Jan 2014 20:39:07 GMT

User error. you can not use earliest or latest as a variable.

<fieldset autoRun="false" submitButton="true">
        <input type="text" token="earliesttime">
          <label>earliest time</label>
          <default>now</default>
        </input>
        <input type="text" token="latesttime">
          <label>latest time</label>
          <default>now</default>
        </input> </fieldset>

Re: Using earliest and latest variables in a form

aholzer — Fri, 10 Jan 2014 20:42:16 GMT

Earliest and Latest follow a very specific format in order to be used. See here for more details: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/SearchTimeModifiers

Something like -1d@d (-1 day snap/truncate to the day) or -1m (-1 minute without truncating).

You'd have to do something like:
<base search> | eval earliest=strftime($ealiest$,"%d/%m/%Y") | search _time >= earliest

Of course your search performance will be impacted because it'll search through ALL your events, and then try to extract those that are after "earliest". I'd stick to timepicker.

Hope this helps

Re: Using earliest and latest variables in a form

poojak2579 — Fri, 19 Oct 2018 22:16:34 GMT

Hi Adylent,
Did you find the solution of this problem?
If yes, please let me know.I am also dealing with the same problem